Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AZ-104 > AZ-104: Deploy and manage Azure compute resources > Flashcards

AZ-104: Deploy and manage Azure compute resources Flashcards

1
Q

Introduction to Azure Virtual Machines

A

Azure Virtual Machines is an on-demand, scalable cloud-computing resource. They include processors, memory, storage, and networking resources. You can start and stop virtual machines at will and manage them from the Azure portal or with the Azure CLI. You can also use a remote Secure Shell (SSH) to connect directly to the running VM and execute commands as if you were on a local computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Unmanaged

A

With unmanaged disks, you are responsible for the storage accounts that are used to hold the VHDs that correspond to your VM disks. You pay the storage account rates for the amount of space you use. A single storage account has a fixed rate limit of 20,000 I/O operations/sec. This means that a single storage account is capable of supporting 40 standard virtual hard disks at full throttle. If you need to scale out, then you need more than one storage account, which can get complicated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

managed disks

A

Managed disks are the newer and recommended disk storage model. They elegantly solve this complexity by putting the burden of managing the storage accounts onto Azure. You specify the disk type (Premium or Standard) and the size of the disk, and Azure creates and manages both the disk and the storage it uses. You don’t have to worry about storage account limits, which makes them easier to scale out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

managed disks BENEFITS

A

Increased reliability: Azure ensures that VHDs associated with high-reliability VMs will be placed in different parts of Azure Storage to provide similar levels of resilience.

Better security: Managed disks are real managed resources in the resource group. This means they can use role-based access control to restrict who can work with the VHD data.

Snapshot support: Snapshots can be used to create a read-only copy of a VHD. We recommend that you shut down the VM to clear out any processes that are in progress. Creating the snapshot only takes a few seconds. Once it’s done, you can power on the VM and use the snapshot to create a duplicate VM to troubleshoot a production issue or roll back the VM to the point in time that the snapshot was taken.

Backup support: Managed disks can be automatically backed up to different regions for disaster recovery with Azure Backup without affecting the service of the VM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is SSH?

A

Secure Shell (SSH) is an encrypted connection protocol that allows secure sign-ins over unsecured connections. SSH allows you to connect to a terminal shell from a remote location using a network connection

There are two approaches we can use to authenticate an SSH connection: username and password, or an SSH key pair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

SSH key pair: a public key and a private key

A

The public key is placed on your Linux VM or any other service that you wish to use with public-key cryptography. This can be shared with anyone.

The private key is what you present to verify your identity to your Linux VM when you make an SSH connection. Consider this confidential information and protect this like you would a password or any other private data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Connecting to the VM with SSH

A

To connect to the VM via SSH, you need:

the public IP address of the VM
the username of the local account on the VM
a public key configured in that account
access to the corresponding private key
port 22 open on the VM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Opening ports in Azure VMs

A

By default, new VMs are locked down.

Apps can make outgoing requests, but the only inbound traffic allowed is from the virtual network (e.g., other resources on the same local network) and from Azure Load Balancer (probe checks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a network security group?

A

Virtual networks (VNets) are the foundation of the Azure networking model and provide isolation and protection. Network security groups (NSGs) are the primary tool you use to enforce and control network traffic rules at the networking level. NSGs are an optional security layer that provides a software firewall by filtering inbound and outbound traffic on the VNet

Security groups can be associated to a network interface (for per host rules), a subnet in the virtual network (to apply to multiple resources), or both levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security group rules

A

NSGs use rules to allow or deny traffic moving through the network. Each rule identifies the source and destination address (or range), protocol, port (or range), direction (inbound or outbound), a numeric priority, and whether to allow or deny the traffic that matches the rule.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How Azure uses network rules

A

For inbound traffic, Azure processes the security group associated to the subnet and then the security group applied to the network interface. Outbound traffic is handled in the opposite order (the network interface first, followed by the subnet)

Keep in mind that security groups are optional at both levels. If no security group is applied, then all traffic is allowed by Azure. If the VM has a public IP, this could be a serious risk, particularly if the OS doesn’t provide a built-in firewall.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Introduction to Windows virtual machines in Azure

A

Azure VMs are an on-demand scalable cloud computing resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Sizing your VM

A

There are quota limits on each subscription that can impact VM creation. By default, you cannot have more than 20 virtual cores across all VMs within a region. You can either split up VMs across regions or file an online request to increase your limit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Azure uses virtual hard disks (VHDs) to represent physical disks for the VM. VHDs replicate the logical format and data of a disk drive but are stored as page blobs in an Azure Storage account

A

Mapping storage to disks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Default DISK creation VM DISK

A

By default, two virtual hard disks (VHDs) will be created for your Windows VM:

The Operating System disk. This is your primary or C: drive and has a maximum capacity of 2048 GB.

A Temporary disk. This provides temporary storage for the OS or any apps. It is configured as the D: drive by default and is sized based on the VM size, making it an ideal location for the Windows paging file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Temp Disk

A

The temporary disk is not persistent. You should only write data to this disk that you are willing to lose at any time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What about data?

A

You can store data on the C: drive along with the OS, but a better approach is to create dedicated data disks. You can create and attach additional disks to the VM. Each data disk can hold up to 32,767 gibibytes (GiB) of data, with the maximum amount of storage determined by the VM size you select

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

RDP

A

When you connect, you’ll typically receive two warnings. These are:

Publisher warning - caused by the .rdp file not being publicly signed.
Certificate warning - caused by the machine certificate not being trusted.
In test environments, these warnings can be ignored. In production environments, the .rdp file can be signed using RDPSIGN.EXE and the machine certificate placed in the client’s Trusted Root Certification Authorities store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

VMS

A

By default, new VMs are locked down
Apps can make outgoing requests, but the only inbound traffic allowed is from the virtual network (e.g. other resources on the same local network), and from Azure’s Load Balancer (probe checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How Azure uses network rules 2

A

The rules are evaluated in priority-order, starting with the lowest priority rule. Deny rules always stop the evaluation. For example, if an outbound request is blocked by a network interface rule, any rules applied to the subnet will not be checked. In order for traffic to be allowed through the security group, it must pass through all applied groups.

The last rule is always a Deny All rule. This is a default rule added to every security group for both inbound and outbound traffic with a priority of 65500. That means to have traffic pass through the security group you must have an allow rule or it will be blocked by the default final rule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

az vm create

A

This command is used to create a virtual machine in a resource group. There are several parameters you can pass to configure all the aspects of the new VM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

verbose

A

lag to see progress while the VM is being created

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

VM Administrator specific

A

We are specifying the administrator account name through the –admin-username flag to be azureuser. If you omit this, the az vm create command will use your current user name. Since the rules for account names are different for each OS, it’s safer to specify a specific name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Public and Private IP

A

When you create a virtual machine, it gets assigned a public IP address that is reachable over the Internet, and a private IP address used within the Azure data center. You get both of those values in the returning JSON block from the create command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

List of VMS

A

az vm image list –output table

This will output the most popular images that are part of an offline list built into the Azure CLI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Location-specific images

A

Some images are only available in certain locations. Try adding the –location [location] flag to the command to scope the results to ones available in the region where you want to create the virtual machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

VM sizing

A

Virtual machines must be sized appropriately for the expected work. A VM without the correct amount of memory or CPU will fail under load or run too slowly to be effective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

viewing size by location

A

az vm list-sizes –location eastus –output table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Standard_DS1_v2

A

so Azure selected a default general-purpose size for us of Standard_DS1_v2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Number of vms per subscription

A

our subscription tier enforces limits on how many resources you can create, as well as the total size of those resources. For example, you are capped to 20 virtual CPUs with the pay-as-you-go subscription, and only 4 vCPUs for a free tier. The Azure CLI will let you know when you exceed this with a Quota Exceeded error. If you hit this error in your own paid subscription, you can request to raise the limits associated with your paid subscription (up to 10,000 vCPUs!) through a free online request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

list available resize options

A

az vm list-vm-resize-options \

- -resource-group learn-0d648c7e-6889-4d0c-b5e6-35906e6bcbd0 \
- -name SampleVM \
- -output table
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

az vm list

A

This command will return all virtual machines defined in this subscription. The output can be filtered to a specific resource group through the –resource-group parameter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

az vm list-ip-addresses -n SampleVM -o table

A

Another useful command is vm list-ip-addresses, which will list the public and private IP addresses for a VM. If they change, or you didn’t capture them during creation, you can retrieve them at any time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Getting VM details

A

az vm show –resource-group learn-0d648c7e-6889-4d0c-b5e6-35906e6bcbd0 –name SampleVM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Adding filters to queries with JMESPath

A

JMESPath is an industry-standard query language built around JSON objects. The simplest query is to specify an identifier that selects a key in the JSON object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Stopping a VM

A

az vm stop \

- -name SampleVM \
- -resource-group learn-0d648c7e-6889-4d0c-b5e6-35906e6bcbd0
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Confirm it’s stoped

A

az vm get-instance-view \

- -name SampleVM \
- -resource-group learn-0d648c7e-6889-4d0c-b5e6-35906e6bcbd0 \
- -query "instanceView.statuses[?starts_with(code, 'PowerState/')].displayStatus" -o tsv
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

az vm start

A

Starting a VM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Retrieve our default page

A

In Azure Cloud Shell, use curl to read the default page from your Linux web server using the following command, replacing with the public IP you found previously. Alternatively, you can open a new browser tab and try to browse to the public IP address

curl -m 10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

opening a port

A

az vm open-port \

- -port 80 \
- -resource-group learn-0d648c7e-6889-4d0c-b5e6-35906e6bcbd0 \
- -name SampleVM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

How disks are used by VMs

Operating system storage

A

Operating system storage. Every VM includes one disk that stores the operating system. This drive is registered as a SATA drive and labeled as the C: drive in Windows and mounted at “/” in Unix-like operating systems. It has a maximum capacity of 4,095 gibibytes (GiB), and its content is taken from the VM image you used to create the VM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Temporary storage

A

Temporary storage. Every VM includes a temporary VHD that is used for page and swap files. Data on this drive may be lost during a maintenance event or redeployment. The drive is labeled as D: on a Windows VM by default. Do not use this drive to store important data that you do not want to lose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Data storage

A

A data disk is any other disk attached to a VM. You use data disks to store files, databases, and any other data that you need to persist across reboots. Some VM images include data disks by default. You can also add additional data disks up to the maximum number specified by the size of the VM. Each data disk is registered as a SCSI drive and has a max capacity of 32,767 GiB. You can choose drive letters or mount points for your data drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Storing VHD files

A

In Azure, VHDs are stored in an Azure storage account as page blobs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Storage account type

General-purpose standard

A

Services supported
Azure Blob storage, Azure Files, Azure Queue storage
Types of blobs supported
Block blobs, page blobs, and append blobs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

General-purpose premium

A

Services supported
Blob storage
Types of blobs supported
Page blobs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Blob storage, hot and cool access tiers

A

Services supported
Blob storage
Types of blobs supported
Block blobs and append blobs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

general and premium storage

A

Both general-purpose standard and premium storage support page blobs. Choose a standard storage account if cost is your primary concern. Premium storage will cost more, but will also deliver much higher I/O operations per second, or IOPS. If data performance is a requirement for your VM, consider using premium storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Attach data disks to VMs

A

The VHD can’t be deleted from storage while it’s attached

Add-AzVhd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

VHDS are created as ?

A

.vhd file as a page blob

Before you can use the new VHD to store data, you have to initialize, partition, and format the new disk. We’ll practice these steps in the next exercise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Azure Disks

A

Azure Disks are designed for 99.999% availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Ultra disks

A

Azure ultra disks deliver high throughput, high IOPS, and consistent low latency disk storage for Azure IaaS VMs. Ultra disks include the ability to dynamically change the performance of the disk without the need to restart your virtual machines (VM). Ultra disks are suited for data-intensive workloads such as SAP HANA, top tier databases, and transaction-heavy workloads. Ultra disks can only be used as data disks. We recommend using premium SSDs as OS disks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Premium SSD disks

A

Premium SSD disks are backed by solid-state drives (SSDs), and deliver high-performance, low-latency disk support for VMs running I/O-intensive workloads. These drives tend to be more reliable because they have no moving parts. A read or write head doesn’t have to move to the correct location on a disk to find the data requested

You can use Premium SSD disks with VM sizes that include an “s” in the series name. For example, there is the Dv3-Series and the Dsv3-series, the Dsv3-series can be used with Premium SSD disks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Standard SSD

A

Standard SSDs are between standard HDDs and premium SSDs from a performance and cost perspective

What if you have a low-end VM, but you need SSD storage for I/O performance? That’s what Standard SSDs are for

55
Q

Standard HDD storage

A

Standard HDD disks are backed by traditional hard disk drives (HDDs). Standard HDD disks are billed at a lower rate than the Premium disks. Standard HDD disks can be used with any VM size

56
Q

Unmanaged

A

With unmanaged disks, you are responsible for the storage accounts that are used to hold the VHDs that correspond to your VM disks. You pay the storage account rates for the amount of space you use. A single storage account has a fixed rate limit of 20,000 I/O operations/sec. This means that a single storage account is capable of supporting 40 standard virtual hard disks at full throttle. If you need to scale out, then you need more than one storage account, which can get complicated

57
Q

managed disks

A

Managed disks are the newer and recommended disk storage model. They elegantly solve this complexity by putting the burden of managing the storage accounts onto Azure. You specify the disk type, and the size of the disk and Azure creates and manages both the disk and the storage it uses. You don’t have to worry about storage account limits, which makes them easier to scale out. Here are some of the benefits you get over the older unmanaged disks

58
Q

Benefits of Managed Disks

A

Increased reliability: Azure ensures that VHDs associated with high-reliability VMs will be placed in different parts of Azure storage to provide similar levels of resilience.
Better security: Managed disks are managed resources in the resource group. This means they can use role-based access control to restrict who can work with the VHD data.
Snapshot support: Snapshots can be used to create a read-only copy of a VHD. You have to shut down the owning VM but creating the snapshot only takes a few seconds. Once it’s done, you can power on the VM and use the snapshot to create a duplicate VM to troubleshoot a production issue or rollback the VM to the point in time that the snapshot was taken.
Backup support: Managed disks can be automatically backed up to different regions for disaster recovery with Azure Backup all without affecting the service of the VM.

59
Q

Ultra Disk Comparison

A

Ultra disk = Disk Type = SSD / Purpose = IO-intensive workloads such as SAP HANA, top tier databases
Max Size = 65,536 gibibyte (GiB)

60
Q

Premium SSD comparison

A

Disk Type = SDD / Purpose = Production and performance sensitive work loads / 32,767 GiB

61
Q

Standard SSD comparison

A

web servers
32,767 GiB
disk type = ssd

62
Q

HDD comparison

A

HDD
32,767 GiB
back ups

63
Q

Locally redundant storage (LRS)

A

Azure replicates the data within the same Azure data center. The data remains available if a node fails. However, if an entire data center fails, data may be unavailable

64
Q

Geo-redundant storage (GRS)

A

Azure replicates your data to a second region that is hundreds of miles away from the primary region. If your storage account has GRS enabled, then your data is durable even if there’s a complete regional outage or a disaster in which the primary region isn’t recoverable

65
Q

Read-access geo-redundant storage (RA-GRS)

A

Azure provides read-only access to the data in the secondary location, and geo-replication across two regions. If a data center fails, the data remains readable but can’t be modified

66
Q

Zone-redundant storage (ZRS)

A

Azure replicates your data synchronously across three storage clusters in a single region. Each storage cluster is physically separated from the others and resides in its own availability zone (AZ). With this type of replication, you can still access and manage your data in the event that a zone becomes unavailable

67
Q

Geo-zone-redundant storage

A

Azure replicates your data synchronously across three availability zones in one region. Data is also replicated three times to another secondary region that’s paired with it.

68
Q

Read-access geo-zone-redundant storage

A

Read-access geo-zone-redundant storage (RA-GZRS) - Azure provides read-only access to the data in the secondary location. Geo-replication is across three availability zones in two region. If a data center fails, the data remains readable but can’t be modified

69
Q

Operations on VHDs

A

Cannot be performed with the VM running. The first step is to stop and deallocate the VM with az vm deallocate, supplying the VM name and resource group name.

Deallocating a VM, unlike just stopping a VM, releases the associated computing resources and allows Azure to make configuration changes to the virtualized hardware.

70
Q

DEALLOCATED A VM

A

az vm deallocate \

  • -resource-group \
  • -name
71
Q

UPDATE A DISK SIZE

A

az disk update \

  • -resource-group \
  • -name \
  • -size-gb 200
72
Q

Storage Service Encryption (SSE)

A

Storage Service Encryption is performed on the physical disks in the data center. If someone were to directly access the physical disk the data would be encrypted. When the data is accessed from the disk, it is decrypted and loaded into memory

73
Q

Azure Disk Encryption (ADE)

A

Azure Disk Encryption encrypts the virtual machine’s virtual hard disks (VHDs). If VHD is protected with ADE, the disk image will only be accessible by the virtual machine that owns the disk

74
Q

Storage Service Encryption (SSE) / 2

A

Azure Storage Service Encryption (SSE) is an encryption service built into Azure used to protect data at rest. The Azure storage platform automatically encrypts data before it’s stored to several storage services, including Azure Managed Disks. Encryption is enabled by default using 256-bit AES encryption, and is managed by the storage account administrator.

75
Q

Azure Disk Encryption (ADE) /2

A

Azure Disk Encryption (ADE) is managed by the VM owner. It controls the encryption of Windows and Linux VM-controlled disks, using BitLocker on Windows VMs and DM-Crypt on Linux VMs. BitLocker Drive Encryption is a data protection feature that integrates with the operating system, and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. Similarly, DM-Crypt encrypts data at rest for Linux before writing to storage

and ADE is required for VMs backed up to the Recovery Vault

With ADE, VMs boot under customer-controlled keys and policies. ADE is integrated with Azure Key Vault for the management of these disk-encryption keys and secrets

76
Q

data at rest

A

(saved to a storage device)

77
Q

Azure Disk Encryption prerequisites

A

Before you can encrypt your VM disks, you need to:

Create a key vault.
Set the key vault access policy to support disk encryption.
Use the key vault to store the encryption keys for ADE.

78
Q

Azure Key Vault

A

Azure Key Vault is a tool for securely storing and accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, or certificates. This provides highly available and scalable secure storage, as defined in Federal Information Processing Standards (FIPS) 140-2 Level 2 validated Hardware Security Modules (HSMs). Using Key Vault, you keep full control of the keys used to encrypt your data, and you can manage and audit your key usage

Azure Disk Encryption requires that your key vault and your VMs are in the same Azure region; this ensures that encryption secrets do not cross regional boundaries

79
Q

powershell and cli commands to manage keyvault

A

New-AzKeyVault -Location `

- ResourceGroupName  `
- VaultName "myKeyVault" `
- EnabledForDiskEncryption

az keyvault create \

- -name "myKeyVault" \
- -resource-group  \
- -location  \
- -enabled-for-disk-encryption True
80
Q

Enable access policies in the key vault

A

There are three policies you can enable.

Disk encryption - Required for Azure Disk encryption.
Deployment - (Optional) Enables the Microsoft.Compute resource provider to retrieve secrets from this key vault when this key vault is referenced in resource creation, for example when creating a VM.
Template deployment - (Optional) Enables Azure Resource Manager to get secrets from this key vault when this key vault is referenced in a template deployment

81
Q

Encrypt an existing VM disk

A

Before you can turn on encryption, you must take a snapshot or a backup of managed disks. The following SkipVmBackup flag tells the tool that the backup is complete on managed disks. Without the backup, you will be unable to recover the VM if the encryption fails for some reason

82
Q

What are Azure Resource Manager templates?

A

Resource Manager templates are JSON files used to define a set of resources to deploy to Azure. You can write them from scratch, and for some Azure resources, including VMs, you can use the Azure portal to generate them. You’ll need to complete the required information for a manual VM deployment, but instead of deploying the VM to Azure, you save the template. You can then reuse the template to create that specific VM configuration

83
Q

Update Management overview

A

The Update Management solution allows you to manage and install operating system updates and patches for both Windows and Linux virtual machines that are deployed in Azure, on-premises, or even in other cloud providers. You can assess the status of available updates on computers and manage the process of installing required updates for servers

84
Q

There are several advantages to the Update Management solution:

A

There are no agents or additional configuration within the virtual machine.
You can run updates without logging into the VM. You also don’t have to create passwords to install the update.
The Update Management solution lists missing updates and provides information about failed deployments in an easy-to-read format

85
Q

Components Used by Update Management

A

The following configurations are used to perform assessment and update deployments:

Microsoft Monitoring Agent (MMA) for Windows or Linux.
PowerShell Desired State Configuration (DSC) for Linux.
Automation Hybrid Runbook Worker.
Microsoft Update or Windows Server Update Services (WSUS) for Windows computers

86
Q

Hybrid Worker Groups

A

Windows computers that are directly connected to your Log Analytics workspace are automatically configured as a Hybrid Runbook Worker to support the runbooks that are included in this solution. Each Windows computer that’s managed by the solution shows up as a system hybrid worker group for the Automation account. The solutions use the naming convention Hostname FQDN_GUID

87
Q

Operations Manager Management Packs

A

If your System Center Operations Manager management group is connected to a Log Analytics workspace, the following management packs are installed in Operations Manager. These management packs are also installed on directly connected Windows computers after you add the solution. You don’t need to configure or manage these management packs.

Microsoft System Center Advisor Update Assessment Intelligence Pack
Microsoft.IntelligencePack.UpdateAssessment.Configuration
Update Deployment MP

88
Q

Compliance scan

A

Update Management will perform a scan for update compliance. A compliance scan is by default, performed every 12 hours on a Windows computer and every 3 hours on a Linux computer. In addition to the scan schedule, a compliance scan is initiated within 15 minutes if the MMA is restarted, before update installation, and after update installation. After a computer performs a scan for update compliance, the agent forwards the information in bulk to Azure Log Analytics.

It can take between 30 minutes and 6 hours for the dashboard to display updated data from managed computers

89
Q

What’s Azure Resource Manager?

A

Azure Resource Manager is the interface for managing and organizing cloud resources. Think of Resource Manager as a way to deploy cloud resources

If you’re familiar with Azure resource groups, you know that they enable you to treat sets of related resources as a single unit. Resource Manager is what organizes the resource groups that let you deploy, manage, and delete all of the resources together in a single action

90
Q

What are Resource Manager templates?

A

A Resource Manager template precisely defines all the Resource Manager resources in a deployment. You can deploy a Resource Manager template into a resource group as a single operation

A Resource Manager template is a JSON file, making it a form of declarative automation. Declarative automation means that you define what resources you need but not how to create them. Put another way, you define what you need and it is Resource Manager’s responsibility to ensure that resources are deployed correctly

91
Q

ARM templates

A

Resource Manager templates

92
Q

Why use Resource Manager templates?

A

Templates improve consistency
Templates help express complex deployments
Templates reduce manual, error-prone tasks
Templates are code
Templates promote reuse
Templates are linkable

93
Q

What’s in a Resource Manager template?

A 
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "",
    "parameters": {  },
    "variables": {  },
    "functions": [  ],
    "resources": [  ],
    "outputs": {  }
}
94
Q

What are Azure Quickstart templates?

A

Azure Quickstart templates are Resource Manager templates that are provided by the Azure community. Quickstart templates are available on GitHub

95
Q

Verifying a template

A

linter, a tool that verifies that the JSON syntax of your template is correct. You can find JSON linting tools that run on the command line, in a browser, or in your favorite code editor

96
Q

Verify syntax of template

A

az deployment group validate

97
Q

What’s the Custom Script Extension?

A

The Custom Script Extension is an easy way to download and run scripts on your Azure VMs. It’s just one of the many ways you can configure a VM once it’s up and running.

You can store your scripts in Azure storage or in a public location such as GitHub. You can run scripts manually or as part of a more automated deployment

98
Q

How do I extend a Resource Manager template?

A

One way to extend your template is to create multiple templates, each defining one piece of the system. You then link or nest them together to build a more complete system. As you create your own templates, you can build a library of smaller, more granular templates and combine them how you need.

Another way is to modify an existing template to suit your needs. You’ll do that in this module because that’s often the fastest way to get started writing your own templates.

99
Q

Specify dependent resources

A

You can’t run the Custom Script Extension until the VM is available. All template resources provide a dependsOn property. This property helps Resource Manager determine the correct order to apply resources.

Here’s what your template resource might look like after you add the dependsOn property

100
Q

code azuredeploy.json

A

open json file editor

101
Q

Compared to physical disks, VHDs have several advantages, including:

A

High availability: Managed disks are designed for 99.999% availability. Managed disks achieve this by providing you with three replicas of your data, allowing for high durability. If one or even two replicas experience issues, the remaining replicas help ensure persistence of your data and high tolerance against failures

102
Q

What is a generalized image?

A

You must reset these items back to a default state before you use the image to create more virtual machines. Otherwise, you might end up with multiple virtual machines that have the same identities. The process of resetting this data is called generalization, and the result is a generalized image

103
Q

After using sys prep for windows

A

After the virtual machine has been shut down, you must deallocate it while it’s in this clean state. If you’re using PowerShell, run the following command

Stop-AzVM -ResourceGroupName `

- Name  `
- Force
104
Q

generalize and image with PowerShell and cli

A

Set-AzVM -ResourceGroupName `

- Name  `
- Generalize

az vm generalize \
–name

105
Q

snapshot

A

A snapshot is a read-only copy of a VHD. You can use a snapshot to restore a VHD to the state it was in when the snapshot was taken

106
Q

What is a virtual machine scale set?

A

Virtual machine scale sets in Azure are designed to allow you to deploy and manage many load-balanced, identical VMs. These machines run with the same configurations. Virtual machine scale sets are intelligent enough to automatically scale up or down the number of VM instances. A scale set can also change the size of VM instances

107
Q

pinging health prob

A

health probe pings the root of the website through port 80

108
Q

Autoscaling

A

Autoscaling is based on a set of scale conditions, rules, and limits. A scale condition combines time and a set of scale rules. If the current time falls within the period defined in the scale condition, the condition’s scale rules are evaluated

109
Q

scale in scale out

A

A scale-out action increases the number of instances. A scale-in action reduces the instance count

110
Q

What is an Azure custom script extension?

A

An Azure custom script extension downloads and runs a script on an Azure VM. It can automate the same tasks on all the VMs in a scale set

111
Q

What is Azure Automation State Configuration?

A

Azure Automation State Configuration is an Azure service built on PowerShell. It allows you to consistently deploy, reliably monitor, and automatically update the desired state of all your resources. Azure Automation provides tools to define configurations and apply them to real and virtual machines

112
Q

What is PowerShell DSC?

A

PowerShell DSC is a declarative management platform that Azure Automation State Configuration uses to configure, deploy, and control systems. A declarative programming language separates intent (what you want to do) from execution (how do you want to do it). You specify the desired state and let DSC do the work to get there. You don’t have to know how to implement or deploy a feature when a DSC resource is available. Instead, you focus on the structure of your deploymen

113
Q

What is the LCM?

A

The local configuration manager (LCM) is a component of the Windows Management Framework (WMF) that’s on a Windows operating system. The LCM is responsible for updating the state of a node, like a VM, to match the desired state. Every time the LCM runs, it completes the following steps:

Get: Get the current state of the node.
Test: Compare the current state of a node against the desired state by using a compiled DSC script (.mof file).
Set: Update the node to match the desired state described in the .mof file.

114
Q

Push and pull architectures in DSC

A

Push mode: An administrator manually sends, or pushes, the configurations toward one or more nodes. The LCM makes sure that the state on each node matches what the configuration specifies.

115
Q

pull mode

A

A pull server holds the configuration information. The LCM on each node polls the pull server at regular intervals, by default every 15 minutes, to get the latest configuration details. These requests are denoted as step 1 in the following diagram. In step 2, the pull server sends the details about any configuration changes back to each node.

116
Q

What is Container Registry?

A

Container Registry is an Azure service that you can use to create your own private Docker registries. Like Docker Hub, Container Registry is organized around repositories that contain one or more images. Container Registry also lets you automate tasks such as redeploying an app when an image is rebuilt.

117
Q

Security is an important reason to choose Container Registry instead of Docker Hub

A

You have much more control over who can see and use your images.
You can sign images to increase trust and reduce the chances of an image becoming accidentally (or intentionally) corrupted or otherwise infected.
All images stored in a container registry are encrypted at rest

118
Q

What is a webhook?

A

Azure App Service supports continuous deployment using webhooks. A webhook is a service offered by Azure Container Registry. Services and applications can subscribe to the webhook to receive notifications about updates to images in the registry. A web app that uses App Service can subscribe to an Azure Container Registry webhook to receive notifications about updates to the image that contains the web app. When the image is updated, and App Service receives a notification, your app automatically restarts the site and pulls the latest version of the image

119
Q

What is the Container Registry tasks feature?

A

You use the tasks feature of Container Registry to rebuild your image whenever its source code changes automatically. You configure a Container Registry task to monitor the GitHub repository that contains your code and trigger a build each time it changes. If the build finishes successfully, Container Registry can store the image in the repository. If your web app is set up for continuous integration in App Service, it receives a notification via the webhook and updates the app.

120
Q

Enable continuous integration from App Service

A

The Container settings page of an App Service resource in the Azure portal automates the setup of continuous integration. If you turn on Continuous Deployment, App Service configures a webhook in your container registry to notify an App Service endpoint. Notifications from the registry that reach this endpoint cause your app to restart and pull the latest version of the container image

121
Q

Extend continuous integration to source control by using a Container Registry task

A

az acr task create –registry –name buildwebapp –image webimage –context https://github.com/MicrosoftDocs/mslearn-deploy-run-container-app-service.git –branch master –file Dockerfile –git-access-token

122
Q

App Service plans and scalability

A

The Free tier provides 1 GB of disk space and support for up to 10 apps, but only a single shared instance and no SLA for availability. Each app has a compute quota of 60 minutes per day. The Free service plan is mainly suitable for app development and testing rather than production deployments.
The Shared tier provides support for more apps (up to 100) also running on a single shared instance. Apps have a compute quota of 240 minutes per day. There is no availability SLA.
The Basic tier supports an unlimited number of apps and provides more disk space. Apps can be scaled out to three dedicated instances. This tier provides an SLA of 99.95% availability. There are three levels in this tier that offer varying amounts of computing power, memory, and disk storage.
The Standard tier also supports an unlimited number of apps. This tier can scale to 10 dedicated instances and has an availability SLA of 99.95%. Like the Basic tier, this tier has three levels that offer an increasingly powerful set of computing, memory, and disk options.
The Premium tier gives you up to 20 dedicated instances, an availability SLA of 99.95%, and multiple levels of hardware.
The Isolated tier runs in a dedicated Azure virtual network, which gives you a network and computes isolation. This tier can scale out to 100 instances and has an availability SLA of 99.95%.

123
Q

Working with images in Container Registry is like working with Docker Hub, but offers a few unique benefits

A

Container Registry runs in Azure. The registry can be replicated to store images near where they’re likely to be deployed.
Container Registry is highly scalable, providing enhanced throughput for Docker pulls that can span many nodes concurrently. The Premium SKU of Container Registry includes 500 GiB of storage.

124
Q

When you create a web app from a Docker image, you configure the following properties:

A

When you create a web app from a Docker image, you configure the following properties:

The registry that contains the image. The registry can be Docker Hub, Azure Container Registry, or some other private registry.
The image. This item is the name of the repository.
The tag. This item indicates which version of the image to use from the repository. By convention, the most recent version is given the tag latest when it’s built.
Startup File. This item is the name of an executable file or a command to be run when the image is loaded. It’s equivalent to the command that you can supply to Docker when running an image from the command line by using docker run. If you’re deploying a ready-to-run, containerized app that already has the ENTRYPOINT and/or COMMAND values configured, you don’t need to fill this in

125
Q

Why use Azure Container Instances?

A

Azure Container Instances is useful for scenarios that can operate in isolated containers, including simple applications, task automation, and build jobs. Here are some of the benefits:

Fast startup: Launch containers in seconds.
Per second billing: Incur costs only while the container is running.
Hypervisor-level security: Isolate your application as completely as it would be in a VM.
Custom sizes: Specify exact values for CPU cores and memory.
Persistent storage: Mount Azure Files shares directly to a container to retrieve and persist state.
Linux and Windows: Schedule both Windows and Linux containers using the same API

126
Q

What are container restart policies?

A

Always Containers in the container group are always restarted. This policy makes sense for long-running tasks such as a web server. This is the default setting applied when no restart policy is specified at container creation.

Never Containers in the container group are never restarted. The containers run one time only.
OnFailure Containers in the container group are restarted only when the process executed in the container fails (when it terminates with a nonzero exit code). The containers are run at least once. This policy works well for con

127
Q

What is a container ?

A

A container is an atomic unit of software that packages up code, dependencies, and configuration for a specific application. Containers allow us to split up monolithic applications into individual services that make up the solution. This rearchitecting of our application will enable us to deploy these separate services via containers.

128
Q

he container concept gives us three major benefits:

A

A container is immutable - the unchanging nature of a container allows it to be deployed and run reliably with the same behavior from one compute environment to another. A container image tested in a QA environment is the same container image deployed to production.

A container is lightweight - you can think of a container as a VM image, but smaller. A VM image is normally installed on a physical host. The image contains both the OS and the application you want to run. In contrast, a container doesn’t need an OS, only the application. The container always relies on the host installed OS for Kernel-specific services. Containers are less resource-intensive, and multiple containers can be installed on the same compute environment.

Container startup is fast - containers can start up in few seconds instead of minutes, like a VM.

129
Q

What is Azure Kubernetes Service?

A

Kubernetes is a portable, extensible open-source platform for automating deployment, scaling, and the management of containerized workloads. Kubernetes abstracts away complex container management and provides us with declarative configuration to orchestrate containers in different compute environments. This orchestration platform gives us the same ease of use and flexibility as with Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) offerings

130
Q

What is Azure Kubernetes Service?

A

Azure Kubernetes Service (AKS) manages your hosted Kubernetes environment and makes it simple to deploy and manage containerized applications in Azure. Your AKS environment is enabled with features such as automated updates, self-healing, and easy scaling. The Kubernetes cluster master is managed by Azure and is free. You manage the agent nodes in the cluster and only pay for the VMs on which your nodes run

131
Q

Connect services by using virtual network peering

A

The traffic uses only private IP addresses. It doesn’t rely on internet connectivity, gateways, or encrypted connections. The traffic is always private, and it takes advantage of the high bandwidth and low latency of the Azure backbone network

132
Q

two types of peering connections

A

Virtual network peering connects virtual networks in the same Azure region, such as two virtual networks in North Europe.

Global virtual network peering connects virtual networks that are in different Azure regions, such as a virtual network in North Europe and a virtual network in West Europe

133
Q

Reciprocal connections

A

When you create a virtual network peering connection in only one virtual network to connect to a peer in another network, you’re not connecting the networks together. To connect the networks by using virtual network peering, you have to create connections in each virtual network

134
Q

Cross-subscription virtual network peering

A

You can use virtual network peering even when both virtual networks are in different subscriptions. This might be necessary for mergers and acquisitions or to connect virtual networks in subscriptions that different departments manage

AZ-104 (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions